In Brief
Kagi adds a paywall filter
Why this matters now: Kagi's search product now gives subscribers a built-in option to automatically remove paywalled links from results, changing how premium search services surface publisher content.
Kagi quietly rolled out a setting to remove paywalled links from your search results as part of a larger changelog that also improved its Stocks widget; details are in the release notes. For Kagi users this is a simple convenience — fewer dead ends, cleaner results — but it also speaks to a broader tension: who controls visibility of publisher content inside AI-forward search experiences. Hacker News reactions praised Kagi’s citation-forward assistant while flagging that assistant answers are only as good as their sources; this setting nudges users toward a clearer, more actionable first pass during research.
“They now use it as a first pass for research,” one thread commenter observed, underscoring why product nudges like this matter beyond UI polish.
Felony Bench: a metric meant to scare
Why this matters now: The Felony Bench benchmark measures how often autonomous agents could inadvertently chain exploits that affect third parties — a new signal for assessing agent danger and containment needs.
A project called Felony Bench counts unique incidents where an agent could “compromise or affect third-party entities,” intentionally framed as “a benchmark you really don't want models to be saturated with.” The project's aim is deliberate: quantify how many attack or legal-crossing steps an agent might invent while following a prompt. The benchmark has already pushed conversations about liability (user vs. host vs. model maker), intent under laws like the CFAA, and whether exposing these attack chains helps or harms security research.
“It’s a benchmark you really don't want models to be saturated with,” the project page warns.
Kobo readers can now run apps (if you're careful)
Why this matters now: BandarLabs' Cobalt turns supported Kobo e‑readers into a signed, low‑privilege app platform, opening a new niche for distraction‑minimal apps and local UIs.
BandarLabs released Cobalt, which installs a tiny launcher and signed App Store on certain Kobo devices (Clara BW tested so far). Apps are Rust static ARM binaries, sandboxed as unprivileged processes that request only the capabilities they need (network, audio, storage). It doesn’t alter the device boot chain — a reboot returns stock — which keeps the hack relatively safe for tinkerers. Expect hobbyist excitement and cautious warnings: this flips an e‑reader into a low‑power app platform, but it’s not a consumer‑grade “install anything” story yet.
Deep Dive
Felony charges after a duress wipe at the US border
Why this matters now: The federal indictment against Samuel Tunick for allegedly using a built‑in duress passcode to wipe his phone during a Customs and Border Protection (CBP) secondary inspection tests the legal boundaries of device searches and traveler privacy.
Federal prosecutors in Atlanta charged Samuel Tunick after they say he used a “duress” passcode that triggered a Pixel phone to erase itself during a CBP encounter; the indictment frames this as obstruction or destruction of evidence. Tunick’s lawyers argue agents detained him unlawfully and denied counsel, while Tunick called the government's search tactics “creepy” in public statements. The New York Times report makes this feel like a legal test case, because phones routinely carry the most intimate and legally sensitive data travelers have.
Why the stakes are high: border agents have wide latitude for warrantless searches at ports of entry, but courts are still sorting out how far that power extends when it collides with encryption, duress features, and attempts to prevent forced access. Practically speaking, the case forces travelers and security-conscious users into trade-offs: resist searches and risk prosecution; comply and risk broad data exposure; or adopt technical workarounds like minimized device footprints, air‑gapped backups, or hardened OSes that complicate inspection. Hacker News debate split between norm defenders and pragmatic operators; a recurring refrain was that technical tricks can only go so far without clearer legal protections.
“There is no technical solution to tyranny,” one commenter wrote, summarizing the limits many HN users see in purely technical defenses.
What to watch next: this prosecution could push appellate courts to clarify whether activating a built‑in wipe during a border inspection is criminal obstruction or a lawful attempt to protect privacy. It may also prompt CBP to change inspection procedures (recordings, counsel access, or new instructions about device passcodes), and it will surely influence traveler habits — from who brings what device to how people configure duress features and backups. For companies building privacy tools, it's a reminder that features designed to protect users can land developers and users into unforeseen legal exposure.
I accidentally logged hundreds of thousands of phone-number ENUM lookups
Why this matters now: A security researcher buying an expired domain briefly controlled ENUM delegations and logged hundreds of thousands of queries — showing how forgotten telecom DNS glue can expose sensitive routing data and targeted calls.
A 19‑year‑old researcher bought a cheap expired domain and, by chance, gained control of parts of the ENUM namespace (e164.arpa) for three country codes tied to remote military locations. ENUM is the DNS system that maps E.164 phone numbers to SIP/VoIP endpoints or routing metadata; it’s niche but real, and an expired nameserver name let the researcher answer ENUM queries. Over months they recorded roughly 400k lookups with full phone numbers, timestamps, and resolver IPs — evidence that an attacker could have rerouted or intercepted calls to sensitive targets. The researcher documented the finding and reported it to RIPE and the UK's NCSC, then wiped logs and handed control back; the post is available on their blog.
One short explainer: ENUM sits at the glue between traditional PSTN numbering and Internet routing for SIP. It’s not used for every phone call, but carriers, gateways, and some interconnects rely on parts of it — especially in private or carrier-to-carrier setups. That makes these delegated DNS zones a high‑value target: if an attacker can answer ENUM queries, they can present fake SIP endpoints or divert routing, creating a stealthy avenue for interception or denial-of-service.
“DNS hijacking is silly,” the author writes, a wry understatement that highlights how brittle operational hygiene can be.
Why this should worry operators and policymakers: the incident shows that much critical telecom infrastructure can fail for trivial reasons — expired names or forgotten delegations — and that the impact is outsized when those failures touch military or government endpoints. For telecom operators and national security teams, this is a prompt to audit DNS delegations, monitor uncommon ENUM activity, and treat expired delegation names as incident-worthy. For the broader security community, it’s another data point that the Internet’s security posture still depends on small, easily overlooked correctness checks.
Closing Thought
Small changes and forgotten bits of infrastructure are doing the heavy lifting in today’s security and privacy stories: a one‑click paywall filter, a duress code on a phone, or an expired DNS name can shift user behavior, legal doctrine, or national security posture. Watch where the seams are — that’s where policy, product design, and real risk meet.